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BACKGROUND OF THE INVENTION 

The invention relates to a method of increasing the 
functional reliability of a motor vehicle that is equipped with 
a data storage device, or a method of operating a motor vehicle 
with a data storage device, and it also relates to a motor 
vehicle with a data storage device. 

The term "data storage device" in the sense of the 
present invention means a device in which data, such as 
operating data of the motor vehicle, can be stored at least 
temporarily in a manner that allows the data to be read back in 
a subsequent reading process. The way in which the data are 
stored is not limited to any specific data storage principle, 
but encompasses all kinds of electrical, electronic, 
electromagnetic, and optical data storage devices as well as 
data storage devices based on other principles. 

Motor vehicles equipped with one or more data storage 
devices are known in the existing state of the art. 
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For example, a motor vehicle is known that has a control 
device as well as a data storage device. While the vehicle is 
in operation, various kinds of operating data are processed by 
the control device. Some of the data being processed remain 
constant during the entire operating time, and some have values 
that vary during the operating time. After the engine has been 
^turned off, the data values are read into the storage device. 
The data storage is organized by means of storage addresses, 
with one data value or parameter value being stored per address. 
When the engine is subsequently started again, the stored data 
values are read back from the storage device into the control 
device . 

When used under ideal conditions, the known motor 
vehicle of the foregoing description, or the known method of 
operating the vehicle or of handling the operating data have 
shown favorable results. 

As a rule, however, the real-world operating conditions 
do not conform to the assumed ideal situation. Under real-world 
conditions, there is, e.g., the risk that a cell or element of 
the data storage device may get damaged at any given time, or 
that the required supply of electric power to the data storage 
device may be interrupted while the transfer of data into the 
device is in process. 
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With a failure of the kind just mentioned, the data 
cannot be retrieved from the storage device when the vehicle is 
started up again. In an extreme situation, the motor vehicle 
could be made entirely inoperable by a failure condition related 
to the data storage. 

Also known is a motor vehicle with a data storage 
device, or a method of operating the vehicle, where the latter 
is equipped with a control device for controlling an actuator 
device of a clutch. In this known arrangement, a target value 
is set for a required amount of clutch actuator travel. 
Furthermore, a command signal is generated to cause an actual 
displacement of the clutch actuator. Preferably, the command 
signal corresponds to the target value or a transformed signal 
representative of the target value. In a situation, where the 
resultant actual displacement is found to stay unchanged (i.e., 
the displacement shows a zero time gradient) , although the 
target value has not yet been reached, the actuator shuts itself 
off and/or a failure is registered. 

The shut-off and/or the failure signal indicates that a 
specific type of malfunction is present in the system. 

The known motor vehicle of the foregoing description 
provides on the one hand a protection against overload of the 
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clutch actuator and on the other hand allows malfunctions in the 
vehicle, or more specifically in the clutch system, to be 
recognized. 



OBJECT OF THE INVENTION 



The present invention therefore has the object of 
providing a method of operating a motor vehicle with a control 
device as well as a data storage device, and also to provide the 
\| vehicle that is operable by the inventive method. The vehicle 

lO according to the invention must meet the criteria of a favorable 

Of! manufacturing cost, uncomplicated construction, a high degree of 

M* data protection, and assured accuracy of the data. In addition, 

CD-5 the method and/or vehicle according to the invention is to 

p provide reliable operational safeguards in cases of malfunction 

combined with effective diagnostic capabilities. 



20 SUMMARY OF THE INVENTION 

According to the invention, the foregoing objective is 
realized in a method of operating a motor vehicle which is 
equipped in particular with an electronically controlled clutch 
25 device, specifically an automatic clutch of the kind that is 
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commercially distributed by the assignee of the present 
invention, e.g., under the designation "Electronic Clutch 
Management". The method according to the invention has the 
steps of: 

5 - storing at least one parameter value, e.g., of an adaptive 

parameter in at least one data storage device; 
- storing at least one check value in at least one data storage 
device; 

wherein the at least one check value serves to verify whether 
ycfLO the parameter value was stored correctly, using a predetermined 



checking characteristic for the verification. 



Thus, in a motor vehicle equipped with an electronically 



controlled clutch device, particularly an automatic clutch 



GL5 



device of the type that is commercially distributed, e.g., by 



the assignee of the present invention under the trade 



designation "Electronic Clutch Management", the invention 



introduces the concept of storing data at predetermined times 



and subsequently retrieving the data from storage, using a 



20 



method or device where at least a part of the stored data is 



backed up by check values, e.g., to increase the operational or 



functional reliability, to detect or avoid errors in the data 



used by the control device, or simply to operate the vehicle. 



The quantities or parameters that are secured by check values 



25 



are preferably adaptive parameters. 
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It should be noted that within the scope of the present 
invention, any value that is entered into a storage device is 
referred to as a storage value. The terms "storage" as well as 
"memory"' or "storage memory" generally relate to any device, 
arrangement or location where a value is stored, as well as to 
the act or process of putting the value into said device, 
arrangement or location. However, in the appropriate context, 
the term "storage" can also refer to the value itself that 
resides in the storage memory. The term "primary storage value" 
or "primary storage" can refer to a value that is stored ahead 
of another value representing the same quantity, and/or to the 
storage of a value in its original format, where the same value 
may at the same time be stored more than once, which may also 
include storages of the same value in modified formats. It 
should be noted that the foregoing terminology is to be applied 
flexibly, and not all of the meanings may apply cumulatively in 
a given context. 

The terms "second storage", "third storage", etc., refer 
to the storing of copies of the same value. A second storage 
value is also referred to as a first redundant value or first 
redundancy, and analogous terminology is used for any higher- 
order storage of the same value. 



According to the invention, the number of multiple 
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copies stored of the same value is in principle unlimited. 
Particularly preferred is a triplicate storage, where a data 
value is stored as a primary storage value, as a first redundant 
value, and as a second redundant value. 

5 

It is also preferred according to the invention, if the 
primary storage retains the full numerical precision of the data 
value, while at least a part of the redundant copies of the 
value are stored in an abbreviated format. However, even if 
y40 values are stored in abbreviated format, it is preferred to 

%A provide a possibility where the original value can be retrieved 

t|j substantially with its original numerical precision. 

Under another preferred embodiment of the invention, the 
PJL5 values can be read back from the storage device with reduced 

£3 precision, i.e., rounded off. 

It is further preferred to use a check value in the form 
of a test number . 

20 

According to the invention, the check value or a given 
checking characteristic makes it possible to determine whether a 
value was stored correctly. In particular, the invention 
provides the possibility to determine whether a value that was 
25 transferred from a control device to a storage device of the 
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vehicle at the end of an operating phase is retrievable 
essentially unchanged at the beginning of the next following 
operating phase. 

It is also preferred if in the case of a storage 
failure, the check quantity or a given detection characteristic 
provides a means for determining the value that should have been 
stored. 

The invention has the advantage that malfunctions in the 
storage device and/or in the data transfer can be immediately 
recognized. Thus, the invention eliminates the risk of using 
erroneous data. The use of a check value further provides the 
possibility of determining the value that actually should have 
been stored. The invention further includes the possibility of 
storing emergency back-up values to be used in cases of extreme 
failures, so that the vehicle always remains operable. 

According to a preferred embodiment of a method 
according to the invention, at least a part of the data that are 
secured by check values consist of one or more operating 
parameters of the motor vehicle. Preferably, these operating 
parameters are adaptive parameters, i.e., parameters that change 
in magnitude during the operation of the vehicle. With special 
preference, the adaptive parameters are at least in part 
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quantities that are optimized for the operation of the vehicle 
through adaption processes that are initiated in a control 
device . 

5 With particular preference, a motor vehicle according to 

the invention has a control device that directs the data 
transfer between the control device and the storage device. 

According to a particularly preferred embodiment of the 
yiO invention, the step of storing a parameter value or a quantity 

in a storage device also includes reading the parameter value or 
^ quantity out of the control device. 

on 

i\ With preference, the step of storing is started with a 

p{L5 primary storage where the value to be stored is simply entered 

p5 into the storage device. The latter is preferably an EEPROM 

device or includes an EEPROM device. 

According to a particularly preferred embodiment of the 
20 invention, the primary storage takes place during a shut-down 

phase of the control device after the "ignition off" signal, 
followed by additional, redundant transfers of the same values 
into storage. Preferably, the redundant copies in storage are 
at least in part identical to the primary storage. 

25 
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According to a particularly preferred embodiment of the 
invention, at least a part of the redundancies are stored in a 
data format that is different from the primary storage. 

It should be noted that the terms "redundancy" and 
"redundant" as used herein refer to the fact that a primary 
storage or primary storage value has associated redundant values 
or redundancies , for short. The redundancies correspond to the 
same quantity or parameter as the primary storage value. 
According to the invention, a primary storage as well as one or 
more redundancies (i.e., a second, third, fourth storage, etc.) 
are provided for a multitude of quantities or parameters, such 
as operating parameters of the vehicle. 

According to a particularly preferred embodiment of the 
invention, the primary storage and/or at least one redundant 
storage are in binary code format. 

With particular preference the 16-bit format, e.g., in 
the form of a 16-bit integer or preferably a 16-bit word, is 
used for the primary storage and/or at least one redundant 
storage . 

Also among the preferred embodiments, the 8-bit format 
(also known as byte format) is used for the primary storage 
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and/or at least one redundant storage. 

According to a particularly preferred embodiment of the 
invention, a value is stored in the storage device, either for a 
primary storage or for a redundant storage, in m bits of an n- 
bit address, where m<n, m and n being positive integers. 

In a 16-bit-word address that is divided into two bytes, 
the bytes are preferably used to store one data value per byte. 

As a preferred example of the last mentioned form of 
data storage, a first redundant copy of a given data value may 
be stored in the first of the two bytes, while a second 
redundant copy of a different value is stored in the second of 
the two bytes. 

It is further especially preferred if a value that is 
represented in a first data format is shifted by one or more bit 
positions prior to being stored. For example, a value 
represented in a 16-bit word format may be shifted according to 
a shifting characteristic that has the form of a table or list 
in such a manner that the upper bits are stored in a second 
format such as a byte format, while the lower bits are cut off. 

As an example of the foregoing concept, a quantity that 
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can take on a value within a range between 0 and 2000 and that 
can accordingly be represented by a maximum of 11 bits may be 
shifted down by three binary positions, whereby the lowest three 
bits are cut off. 

It should be noted, of course, that the invention also 
covers the possibility of cutting off the higher bits. The 
choice of whether to cut off the high-end bits or the low-end 
bits depends on the purpose that is to be accomplished. For 
example, if a value is to be represented where the variation 
includes the high-end of the bit positions, cutting off the low- 
end bits will not affect the relative significance of the value 
by very much. If on the other hand a value is to be represented 
which, based on its nature, does not change in the upper bits 
and shows variations only in the lower bit positions, it can be 
more advantageous to cut off (or shift out) the upper bits in 
order to make room for representing the lower bits exactly. 

The invention is in no way limited with regard to 
shifting or cutting either the lower or the higher bits that 
make up data values. 

It should be noted that the shifting or truncating of 
data values can lead to rounding errors (which may in some cases 
be intended) , but that such rounding errors are not always a 
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necessary consequence. An error occurs, for example, with a 
preferred embodiment of the invention where, in a subsequent 
reading of shifted data values, the bits that were dropped in 
the storing phase are set at arbitrary or predetermined values 
that are not the same as in the primary storage. 

The invention also includes embodiments where no 
rounding errors occur, for example if shifted or truncated 
values are read from a redundant storage and the dropped bits 
are retrieved from the primary storage. 

The latter concept has the advantage that it requires 
less storage memory, while the values read back from the storage 
device still have a high degree of numerical precision and 
reliability. 

According to a particularly preferred embodiment, a 
first step in the inventive method is to determine the level of 
precision to be used in storing a given value. This may also 
include a determination of whether the relevant information is 
contained in the higher or lower bits of the value. 

Depending on the result of the foregoing determination 
and also depending on the magnitude of the value, the number of 
bits for shifting the value is set, and the value is shifted and 
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stored accordingly. 

In accordance with a particularly preferred embodiment 
of the invention, values related to the neutral position of the 
transmission, or at least one leg of the shift pattern, at least 
one rest position or at least one friction-related value of the 
clutch are stored in triplicate, with the second and third 
storage value (first and second redundancy, respectively) being 
shifted before storing by two positions and then stored in byte 
format- It is also preferred to use an address in word (16-bit) 
format to store the bytes. 

According to a particularly preferred embodiment of the 
invention, the value for a point of engagement is shifted by 
three bit positions before entering it into second and third 
storage . 

It is also preferred to store adaptive parameters in 
triplicate, with the primary storage in a first word address, 
the second storage in a first byte of a second word address, and 
the third storage in a first byte of a third word address. It 
is particularly preferred if the second address and the third 
address are consecutive addresses. 

According to a particularly preferred embodiment of the 



-14- 



3191/01388 

invention, at least some of the addresses or at least parts of 
the addresses are occupied by a default code prior to storing a 
data value, for example "FFFF" or "11111111" or 
"1111111111111111". 

The default code serves, e.g., as an indicator that a 
data value was not stored correctly, in case a malfunction 
occurs, before, during or after entering a value into storage. 

In the storing process, the default code is overwritten 
with the value to be stored. If the transfer of a value into 
storage is not executed correctly, the default code will not be 
overwritten, i.e., stay in place. Thus, a malfunction in 
storing a value can be immediately recognized. 

According to a particularly preferred embodiment of the 
invention, the redundancies are always stored after the primary 
storage has been carried out. 

Also in accordance with a particularly preferred 
embodiment of the invention, test numbers or test codes are used 
either in addition to or in place of stpring multiple, redundant 
copies of the same values. 

The test numbers or test codes are assigned, e.g., 
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before, during or after storing a value. With preference, the 
test numbers or test codes are not full representations of the 
value, but only indicators of certain individual criteria. 

For example, a test number may indicate how many bit 
positions are occupied and/or it may be the sum of the binary 
values set at the individual bit positions. 

Also among the preferred embodiments is the concept that 
one test number is used to cover a plurality of different 
addresses . 

According to another preferred embodiment of the 
invention, a test number is made up of the sum of the bit values 
at a plurality of different addresses. Also among the preferred 
embodiments, a plurality of test numbers or test codes can be 
used to secure the contents of a single address or to secure the 
contents of a plurality of addresses. 

The preferred embodiments include saving the test 
numbers or test codes at an address other than the one that is 
being secured, as well as saving the test numbers or test codes 
at the same address . 

Preferably, an assignment characteristic is set up for 
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the test numbers, to define how the test numbers are related to 
the data values. 

According to a particularly preferred embodiment, the 
storage device includes an EEPROM or is part of an EEPROM 
(Electronically Erasable Programmable Read-Only Memory) . A 
suitable type of EEPROM has, for example, 128 words, i.e., a 
format of 128 x 16. It is also possible to use EEPROMS with 
64 x 16 and 256 x 16 format. Other formats can also be used. 

According to a particularly preferred embodiment of the 
invention the EEPROM is used to store values that vary at least 
in part during the operation of the vehicle, e.g., adaptive 
values, as well as to store values that remain constant during 
the operation of the vehicle. 

With particular preference, an EEPROM has a portion of 
its capacity reserved for addresses that are used to store error 
data . 

It is further preferred if a storage device has a 
location where a preset substitute value is stored for at least 
one adaptive quantity. A substitute value may, for example, be 
used as a backup if a storage error is detected and a parameter 
value that was entered from the control device into the storage 
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device cannot be reconstituted even with the redundant storage 
data . 

According to a particularly preferred embodiment of the 
invention, at least one portion of the data storage device is 
reserved to store values that can be used to check the values of 
the adaptive parameters or the values that are transferred 
between the control device and the data storage device. 

As an example of test values, the data storage device 
may contain range limits of the values that can be assumed by 
the parameter data that are transferred between the storage 
device and the control device. 

This allows values to be detected that were stored 
incorrectly, so that they are either too large or too small. 

The invention further includes the storing of 
calibration values. According to a particularly preferred 
embodiment, the characteristic for shifting the values, such as 
a list or table, is stored separately. This applies in 
particular to a mask characteristic that is used to read back 
the shifted values. 

According to a particularly preferred embodiment, the 
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control device is reset from time to time. Reset times may be, 
for example, when the vehicle is put into one of the states 
"ignition on" or "wake-up". 



5 It is also preferred, when reading back stored data 

values, to transform the data before, during or after the 
reading, i.e., to put the data into a different format. This is 
particularly applicable, if the same values were transformed 
™ once before, when they were entered into the data storage 

%0 device. In this case, the values are preferably subjected to a 

= ..1 kind of back-transformation, e.g., by putting values that were 

m stored in byte format back into a word format. It is 

J" particularly preferred to bring back the cut-off bytes in 

fj accordance with a given characteristic. This characteristic 

gjL5 can, e.g., consist of a given correlation list of values that is 

stored permanently. It is further preferred if the primary 
storage is in word format, while the second and third storage 
are in byte format. In the transformation of the redundant 
values that are stored as bytes, the dropped bits in the 
20 redundant values can be replaced from the word format of the 

corresponding primary storage address. 

It is preferred if bits that are reconstituted in this 
manner are of lesser significance than the other bits. 

25 
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Preferably, the redundancies that were stored as bytes 
are shifted again before, during or after they are read back 
and/or transformed. 

Preferably, the shifting at the retrieval of the data 
from storage is performed according to a characteristic that is 
substantially the reverse of the shifting characteristic used 
for storing the data. This means that preferably, the shift 
that was made when storing the data is reversed. For example, 
the data stored in byte format are restored to a larger format. 
Preferably, at least a part of the retrieved values is fitted to 
format masks before, during or after they are read back or 
transformed. 

It is particularly preferred if based on the primary 
storage values, the dropped bits are reattached to the redundant 
copies of the values. According to a particularly preferred 
embodiment of the invention, the individual stored copies that 
are based on the same adaptive value or the same quantity are 
subsequently compared, e.g., by comparing the redundant storage 
values to each other, or by comparing the primary storage value 
to the redundant storage values. Also among the preferred 
concepts of the invention, at least a part of a primary storage 
value is compared to at least one redundant storage value, or 
vice versa. For example, the bits of a redundant storage value 
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in byte format are compared (taking the shift of bit positions 
into account) to the corresponding bits of the primary storage 
of the same value which is in word format. 

It should be noted that the possible ways of comparing 
are not limited to the foregoing examples. Those skilled in the 
art will know of a multitude of other possibilities of comparing 
data. For example the invention provides that the comparison is 
made before the transformation or a process similar to a 
transf ormation, but the sequence could also be reversed in 
another preferred embodiment of the invention. 

According to a particularly preferred embodiment of the 
invention, a value is selected, preferably among the storage 
values and in accordance with a selection characteristic, as a 
working value or preliminary working value for at least one 
operating variable or for all of the operating variables. 

The selected value in the selected format can be entered 
directly or indirectly into the y-controller or into any other 
controller device. It is also preferred if the selected value 
is modified before being entered. 

For example, the selected value or preliminary working 
value can be a primary storage value, or a redundant storage 
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value or a transformed redundant storage value, or a mask-fitted 
storage value, or another comparison value. The term 
"comparison value" means in particular any value used in a 
comparison for selecting the working value. 

Preferably, a storage value or comparison value is 
selected according to a predetermined characteristic for use as 
a working value or a preliminary working value as one of at 
least two comparison values that deviate from each other by less 
than a prescribed maximum allowable deviation. Preferably, the 
maximum allowable deviation is of a constant value. Also among 
the preferred concepts, the maximum allowable deviation can be 
given in the form of a mathematical function or relationship 
that depends, e.g., on the magnitude of the storage values. 

With particular preference, a value is selected as a 
working value or preliminary working value, if it is 
substantially identical with a second comparison value. In 
particular, a primary storage value is considered identical to a 
redundant storage value, if the redundant storage does not have 
all of the bits of the primary storage, but if the bits at the 
positions that they have in common are identical. 

It is also preferred to select the value that occurs 
with the highest frequency among all storage values of the same 
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operating variable or of the same quantity. For example, if 
working variables are stored in triplicate and the value in one 
of the three storage locations differs from the other two, the 
value that occurs in two of the locations is selected. If the 
5 values are identical in all three storage locations, it is 

preferred to select the primary storage value. 

It is particularly preferred to select the primary 
storage value if one of the redundant storage values, e.g., the 
y.0 second storage, contains an error code such as "FFFF". The 

J* presence of an error code indicates, e.g., that the power supply 

'tj was interrupted during at least part of the storage process. 

~ This type of error code will appear during data retrieval for 

j\ example if the battery was disconnected in a storage phase that 

took place after turning off the engine. 

It is further a preferred concept of the invention, to 
assign fictitious bands of a certain bandwidth to storage values 
that relate to the same operating variable or the same quantity. 
20 The number of bands is essentially arbitrary, but preferably 

limited by the number of different storages. For example, the 
bands may be assigned to the storage values according to the 
conditions that every storage value lies within a band and every 
band contains as many values as possible. 
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It is preferred to give more weight to the condition 
that every storage value lies within a band. This means in 
particular that an individual band is preferably not 
repositioned in order to get more storage values to lie within 
the band, if this would cause another value to fall outside the 
band. It is preferred, for example, to assign a band to each 
storage value and to reposition the band in relation to the 
storage value so that on the one hand, the storage value 
continues to be included in the band and on the other hand as 
many storage values as possible lie within the band. 

It is particularly preferred to subsequently select a 
value from the band that contains the most values for further 
use in the operation of the vehicle. The selected value can be, 
for example, one of the storage values, or else any arbitrary 
value within the band or interval in which the greatest number 
of storage values are found. 

It is further a preferred concept of the invention to 
select a substitute value for the continued operation of the 
vehicle if none of the comparison values are found to be 
suitable for the operation of the vehicle, or if there is an 
excessive level of uncertainty that the available value was 
stored correctly. A substitute value could be generated, or it 
could be stored in a table or list from which it can be 
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retrieved. Preferably, a substitute value is stored with 
reference to specific operating parameters. 

It is further preferred to select a substitute value if 
the number of disagreeing comparison values or storage values in 
relation to the total number of storage entries for the same 
value is larger than a prescribed ratio. 

It is also preferred to use a substitute value as a 
working variable if all of the storage values for that variable 
are different from each other. It is particularly preferred to 
have three stored copies of a value, namely a primary storage 
and two redundant stored copies, where the substitute value is 
used if the primary storage is found to be different from the 
first or second redundant copy and at the same time the first 
redundant copy is different from the second redundant copy. 

With particular preference, the selected substitute 
value is retrieved from a stored table or assignment 
characteristic and entered into the Y-controller or into a 
control unit. It is particularly preferred to choose the stored 
substitute values under the criterion that they allow, and 
preferably assure, the vehicle to be operable, and that the 
substitute values be matched to the control device in such a 
manner that the adaptations performed by the control device 
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during the operation of the vehicle will not cause the operating 
variables to take on values outside a permissible range. 



It is also preferred to use a substitute value only in 
5 cases where all of the storage values are different and none of 

them contains an error code. 



Nevertheless, the scope of the invention also includes 
the case where a substitute value is used especially in the case 
J3L0 where a storage value contains an error code. 

C 5 It is further preferred in establishing a substitute 

CP value, if the latter is determined dependent on the magnitude of 

the comparison values or storage values. 



4.5 



20 



As an example, a substitute value is established 
according to a defined characteristic, where the latter depends 
on the storage values or on the limits of a band that contains 
the maximum number of storage values, as discussed above. 



It is also preferred if the substitute values are stored 
in an area of the storage memory that is substantially uncoupled 
from the memory area occupied by the primary storage values and 
the redundant copies. Consequently, in case of a failure in the 
25 memory area for the primary storage values and the redundant 
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copies, the substitute value will still be available. 



It is also particularly preferred if an emergency 
driving strategy is initiated when an error in gear-shifting 
thresholds has been detected. For example, an emergency driving 
strategy may be adopted in a case where a substitute value for 
the gear-shifting threshold would has been or would have to be 
determined. This applies, e.g., to the case where all of the 
comparison values are different from each other. In this case, 
it is preferred to set an implausible value for the gear- 
shifting thresholds. An implausible value in general is a value 
that lies outside of a range of permissible values. The choice 
of an implausible value for the gear-shifting thresholds is 
preferred if there is no other way of assuring that the 
malfunctions will not reach a magnitude where no substitute 
values can be calculated that will guarantee the safe 
functioning of the gear-shifting process. If the safe function 
of the gear shifts is assured - a case that is also included in 
the scope of the invention - it is also preferred to set the 
shifting thresholds on the basis of plausible substitute values. 
Under a further preferred concept of the invention, a test is 
performed in the retrieval of the storage values, as to whether 
or not the values in memory were stored correctly, based on the 
test number or test code. 
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Test numbers can be used as a supplementary measure in 
addition to storing multiple copies of values. In a preferred 
embodiment, test numbers are used in place of storing multiple 
copies. In the case, where a value was stored only once and at 
least one test code or test number was used, it is preferred to 
use the storage value as operating variable if the test code or 
test number confirms the storage value. This procedure applies 
analogously to the case where more than one test code or test 
number is used. 

If test codes or test numbers are used in combination 
with storing multiple copies, it is further preferred to check 
the storage values as to whether or not, e.g., a storage of a 
rank i was entered into memory correctly, based on the test 
numbers. The rank i stands for the ordinal number assigned to a 
storage value, as in primary, second, third storage, etc. If 
the test number or test code confirms the storage value, the 
latter is marked through a further procedural step as being 
eligible for use as an operating variable. If the check shows a 
discrepancy, the storage value is rejected from being used as an 
operating variable. It is also a preferred concept to replace 
rejected values by substitute values. This may be applied with 
only a single storage as well as with multiple stored copies of 
values . 
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It is also preferred to use substitute values if the 
probability that a storage value was entered correctly into 
memory is lower than a prescribed probability level. 

The values that are transferred from the storage memory 
to the control device are preferably selected values in the 
above-defined sense, i.e., values that have passed an at least 
preliminary selection . 

As a particularly preferred concept, a selected value is 
checked for plausibility either in the control device or prior 
to the transfer of the value into the control device. The 
values subjected to this test can be, e.g., primary storage 
values, redundant copies of values, transformed redundant 
copies, mask-fitted redundant copies, or other comparison 
values . 

For example, a plausibility check may consist of or 
include a verification that a selected value lies within a given 
band of permissible values. Preferably, the band is defined by 
interval limits that are stored in memory and are of a magnitude 
which assures, in the case of adaptive parameters, that the 
adaptions performed by the control device during the operation 
of the vehicle will not cause the respective parameter value to 
fall out of the check interval. 
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It is preferred under the inventive method to use a 
substitute value if the selected value has been found to be 
implausible. For example, substitute values may be 10 mm for 
the point of clutch engagement , 0.27 for the friction 
5 coefficient, "0" (zero) for the vehicle code, or 90°C for the 

clutch temperature. 

It is also preferred if, after a value has been found 
implausible, another value for the same parameter is retrieved 
y.0 in a subsequent cycle of the program loop, with the implausible 



value being disregarded. 



A particularly preferred embodiment of the invention 



includes the setting of error codes, such as error bits or error 



RL5 



flags, if certain predetermined errors or error combinations 



have been detected. For example, an error bit may be set if a 



primary storage does not agree with all of its associated 



redundant storage values, or if any of the comparison values do 



not agree with each other. Another case for setting an error 



20 



bit may be if a storage location contains an error code such as 



FFFF 



With particular preference, an error bit is set if all 



of the comparison values differ from each other, causing a 



substitute value to be selected. Another preferred case for 



setting an error bit occurs if an error is detected in a gear- 



25 



shifting threshold value. An error bit may further be set, if a 
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plausibility check shows a value to be implausible, e.g., 
because the value is outside of a permissible range. 

Preferred embodiments of the invention further include 
5 using a corrected value for an operating parameter if an error 

bit or error code has been set for that operating parameter. 

A further preferred concept is to make an entry in an 
error-storage memory in cases where certain error codes have 
yjjO been set. 

gQ For example, an embodiment of the invention provides 

fp that an entry is made in the error-storage memory if an error 

U bit was set to indicate that all of the storage values or 

Ci_5 comparison values have been found to be different from each 

O other. 

As another example, an entry in the error-storage memory 
may be made if an error bit was set to indicate that a value was 
20 found to be implausible. 

The object of the invention is further met by a method 
of making the operation of a motor vehicle more reliable. The 
increase in reliability is achieved through the following steps: 

25 
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a) A displacement-versus-time function is set as a control 
target for the movement of an actuator of a torque- 
transmitting device, for example a clutch. The targeted 
displacement-versus-time function can be characterized by 
one or more target values to be met by one or more 
predetermined parameters of the function at one or more 
predetermined times. 

b) A command signal is issued for the actuator to perform a 
movement according to the targeted displacement-versus-time 
function of step a) . As a result, the actuator will move 
according to an actual displacement-versus-time function 
characterized by one or more actual values that the 
predetermined parameters assume at the predetermined times. 

c) The one or more actual values are compared to the respective 
target values . 

d) A determination is made, whether the one or more actual 
values deviate from the respective target values to an 
extent that meets a first set of characteristic error 
criteria . 

e) If the result of step d) is affirmative, one or more first 
error entries are made into a storage memory for error 
entries, and/or the presence of at least one first 
malfunction is registered. 

f) A further determination is made, whether the one or more 
actual values deviate from the corresponding target values 
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to an extent that meets further sets of characteristic error 
criteria, which may be referred to by an ordinal number of 
j>2, for example a second or third set of error criteria, 
g) If the result of step f) is affirmative, one or more "j-th" 
(ordinal-j) error entries are made into an error storage 
memory, and/or the presence of at least one ordinal-j 
malfunction is registered. 

The foregoing method is designed to make a vehicle 
operate more reliably, to detect and/or avoid control- and/or 
operating errors in a vehicle, and/or to operate a vehicle, 
particularly of a kind that is equipped with the aforementioned 
"electronic clutch management" system. The method is based on 
the principle of setting a target characteristic of an actuator 
and then measuring or determining the actually occurring 
behavior. If discrepancies of a certain magnitude are detected 
between corresponding parameters of the target characteristic 
and the actual behavior, the occurrence of a malfunction is 
entered in an error storage memory and/or the presence of an 
error is registered. 

The invention is distinguished in that a finer 
differentiation is made when an error occurs, in contrast to the 
existing state of the art, where only one kind of error is 
registered. 
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For example, an error entry is made (and/or the actuator 
is deactivated) according to the invention not only if the 
actuator fails to move (where the time gradient of the actuator 
displacement is essentially zero), but also if a certain amount 
of discrepancy exists between the targeted time gradient and the 
actually occurring time gradient of the actuator displacement. 
Preferably, a differentiation is made between a case where the 
targeted displacement gradient is significantly larger than the 
actually occurring displacement gradient and another case where 
the actually occurring displacement gradient is zero. 

The differentiation between different degrees of target- 
versus-actual discrepancies allows a more detailed evaluation of 
malfunctions in a vehicle with a clutch device than prior-art 
methods. For example, the invention provides the possibility of 
indicating an undesirable hydraulic throttling resistance or 
increased friction in the actuator, e.g., if the actually 
occurring displacement gradient is significantly smaller than 
the targeted gradient. If there is no movement (displacement 
gradient) even with an overload on the actuator, this would 
indicate that the actuator is blocked or jammed. 

The inventive method of the foregoing description is 
used to particular advantage with an actuator of a torque- 
transmitting device such as a clutch. 
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With particular preference, the actuator device in the 
context of the present invention is based on a kinetic principle 
(as compared to, e.g., an electrical principle). A typical 
example is a hydraulic actuator device with at least one master 
cylinder containing a master-cylinder piston with a master- 
cylinder piston rod as well as a slave cylinder containing a 
slave-cylinder piston with a slave-cylinder piston rod. A 
hydraulic conduit connects between port openings of the 
cylinders at the ends that face away from the piston rods. The 
system constituted by the cylinders and the conduit preferably 
contains a hydraulic fluid at least part of the time. The 
master cylinder according to a preferred embodiment of the 
invention further has a sniffle bore that connects to a 
container holding fluid under at a pressure that is essentially 
independent of the fill level of the container. This 
arrangement of a container and a sniffle bore serves in 
particular to maintain a constant fill level, pressure and 
composition of the hydraulic fluid in the system. 

In preferred embodiments of the invention, the slave- 
cylinder piston rod is connected to and acts on an actuator 
device for actuating the clutch. 

A device for controlling the master-cylinder piston may 
include its own actuator or a hydraulic control device. The 
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hydraulic control device can be part of an extisting hydraulic 
circuit of a motor vehicle. 

According to a particularly preferred embodiment of the 
invention, a malfunction is registered and/or an error is 
entered in a storage memory if at a certain time within a 
prescribed time window the target displacement deviates from the 
actually occurring displacement by more than a predetermined 
maximum allowable displacement deviation. 

Further among preferred embodiments of the invention, a 
malfunction is also registered and/or an error is entered in a 
storage memory if at a certain time within a prescribed time 
window the target displacement gradient deviates from the 
actually occurring displacement gradient by more than a 
predetermined maximum allowable gradient deviation. 

Furthermore, a malfunction can also be registered if at 
a certain time within a prescribed time window the target 
displacement deviates from the actually occurring displacement 
by more than a predetermined maximum allowable displacement 
deviation while at the same time, the actually occurring 
displacement gradient is smaller than a predetermined minimum 
allowable gradient of the actually occurring displacement. 
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It is particularly preferred if different kinds of 
malfunctions are differentiated by different entries into the 
error storage memory. 

For example, a first error entry may indicate that the 
actually occurring displacement gradient was within a certain 
(non-permissible) range, while a second error entry may 
indicate, e.g., that the actually occurring displacement 
gradient was zero. 

It is also preferable to set the minimum allowable 
gradient for the actually occurring displacement at a value 
greater than zero. 

The maximum allowable deviation from a targeted 
displacement function or from a targeted displacement gradient, 
or the minimum allowable actual displacement gradient can for 
example be set as a constant value. 

Nevertheless, the scope of preferred embodiments also 
includes that the maximum allowable deviation from a targeted 
displacement function or from a targeted displacement gradient, 
or the minimum allowable actual displacement gradient is given 
in the form of a function that depends, e.g., on the given 
targeted displacement function. 
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According to a particularly preferred embodiment of the 
invention, a targeted increase or decrease of the displacement 
is given, and the time interval is measured that a reference 
component of the actuator takes to match the targeted increase 
or decrease in displacement. Based on a characteristic 
correlation between displacements and allowable time intervals, 
a determination is made whether a malfunction has occurred and 
if so, what kind of malfunction. 

It is further preferred to differentiate between two 
ways of measuring the time taken to accomplish a targeted 
increase or decrease in displacement. For example, a first way 
is to measure the time that it takes for a reference component 
of the actuator to travel a predetermined distance. 

Another possibility is to measure the time it takes for 
the reference component to settle into a prescribed target 
position. This would be the case, if the reference component 
approaches the target position through a transient oscillation, 
overshooting the target at first and changing direction back and 
forth while zeroing in on the target position. Combinations of 
the two ways of measuring the time for the change in actuator 
position are also conceivable under the present invention. 



It is among the preferred concepts of the invention to 
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use prescribed model functions of a displacement-versus-time 
characteristic for diagnostic purposes in a repair shop. With 
particular preference, the diagnostic model functions are 
specially tailored to check a vehicle for specific malfunctions. 

It is further preferred to measure and evaluate the 
differences between actual and targeted displacement and/or 
between actual and targeted displacement gradient during the 
normal operation of the vehicle. This allows a malfunction to 
be indicated or corrected while the vehicle is in operation. 

In situations where a malfunction has been registered or 
an error has been entered in the error memory, a preferred 
embodiment of the inventive method provides that the actuator be 
switched off. A further preferred measure in such situations is 
to make corrections to the targeted displacement-versus-time 
function . 

According to a particularly preferred embodiment of the 
invention, a specifically designed function for evaluating the 
dynamic system behavior is prescribed as the targeted 
displacement-versus-time function . 

In a particularly preferred embodiment of the invention, 
a plurality of different displacement-versus-time functions are 
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given as control targets, and the resulting actual displacement 
behaviors are measured. Based on combinations of different 
responses to different target inputs, it is possible to draw 
additional diagnostic conclusions. 

Examples of target input functions according to the 
invention include a substantially slow displacement-versus-time 
function and also, with particular preference, a substantially 
fast displacement-versus-time function. 

It is particularly preferred to set a fast and then a 
slow displacement-versus-time function following each other as 
input targets. This sequence of input targets could be used, 
e.g., for the following evaluation: If an error was registered 
only with a substantially fast displacement-versus-time target 
input, and no error was registered with a substantially slow 
displacement-versus-time target input, this would indicate an 
undesirable throttling resistance in the hydraulic system. 

As another example, if an error is registered with both 
fast and slow displacement-versus-time target profiles, this 
would allow the conclusion that an undesirable friction effect 
is present. 

The object of the invention is further met by a motor 
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vehicle that is equipped with at least one control device and at 
least one data storage device, wherein under predetermined 
situations data are transferred from the control device to the 
data storage device or vice versa. At least parts of some of 
the data can be stored in the data storage device in more than 
copy, for example in triplicate. An exemplary vehicle of this 
kind can be equipped with a control device to carry out the 
inventive method in any of its various forms as disclosed in the 
foregoing description. 

It should be noted that in cases where features are 
connected herein by the word "or", this can be meant in the 
sense of a logic OR (one or the other or both) or as an 
exclusive "or" (one or the other, but not both) , depending on 
the context . 

Further, the words "control" and "regulation" as well as 
their various derivatives are intended herein to encompass a 
broad range of meanings, including in particular all kinds of 
closed-loop and open-loop regulation and control systems and 
methods in the sense of the applicable DIN standards. 

The novel features that are considered as characteristic 
of the invention are set forth in particular in the appended 
claims. The improved apparatus itself, however, both as to its 
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construction and its mode of operation, together with additional 
features and advantages thereof, will be best understood upon 
perusal of the following detailed description of certain 
presently preferred specific embodiments with reference to the 
accompanying drawing. 

BRIEF DESCRIPTION OF THE DRAWINGS 

The following detailed description of the invention is 
based on the attached drawing in which 

Fig. 1 represents an exemplary embodiment of the method 
according to the invention in flow-chart format; 

Fig. 2 represents a first example of a system malfunction 

that can be detected by the inventive method based on 
a discrepancy between a given control target and the 
actually occurring behavior of the system; and 

Fig. 3 represents a second example of a system malfunction 

that can be detected by the inventive method based on 
a discrepancy between a given control target and the 
actually occurring behavior of the system. 
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DETAILED DESCRIPTION OF THE INVENTION 

Fig. 1 illustrates an exemplary embodiment of the method 
according to the invention in flow-chart format. 

In particular, the flow-chart shows those method steps 
that are performed to retrieve data that have been stored in 
multiple copies from storage memory back into the control device 
or specifically into the y-controller . 

In step 10, the control device is reset and initialized. 
Next, the three values that are stored in memory for each 
adaptive quantity, i.e., a primary storage value and two 
redundant storage entries, are read back in step 12 from the 
EEPROM. 

In step 14, the two redundant storage entries, which are 
stored at different addresses as one byte each, are expanded to 
word format . 

In step 16, the second and third storage entries are 
fitted to masks and compared to each other and/or to the primary 
storage value . 



If the three values being compared (also referred to 
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herein as comparison values) are identical, the value of the 
primary storage entry is tentatively assigned to the adaptive 
quantity (step 18) . If the primary storage value and one of the 
redundant values are the same but the other of the redundant 
5 values is different, the primary storage value is tentatively 

assigned to the adaptive quantity (step 20) . If the two 
redundant values agree but the primary value is different, the 
first redundant value is tentatively assigned to the adaptive 
quantity (step 22) . 

fi If all of the three storage entries are different from 

^ each other, a differentiation is made according to step 24, as 

1 follows: If the second entry (i.e., the first redundant entry) 
f = contains an error code, the primary storage value is tentatively 
gL5 assigned to the adaptive quantity (step 26) . If the second 

2 entry contains no error code, a substitute value is assigned to 
^ the adaptive quantity (step 28). The value that was assigned to 

the adaptive quantity in one of the steps 20, 22, 26, or 28 is 
entered into the storage device (EEPROM) in place of the non- 
20 conforming previous data (step 30) . Next, in step 32, the value 
tentatively assigned to the adaptive quantity in one of the 
steps 18, 20, 22, 26 is checked for plausibility. 

If a substitute value was assigned to the adaptive 
25 quantity (step 38), a bit flag is set in the error storage 
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memory. If the error was found to lie in the gear-shifting 
threshold values, an emergency driving strategy is initiated 
(step 40) . 

If all of the values going through step 32 have been 
found plausible, the illustrated subroutine is essentially 
completed and the vehicle is operational with the retrieved and 
checked values of the adaptive constants. However, if a value 
of an adaptive quantity is found implausible in step 32, a 
substitute value is assigned and a bit flag is set in the error 
storage memory (step 34) . If the error was found to lie in the 
gear-shifting threshold values, an emergency driving strategy is 
initiated (step 36) . 

Fig. 2 illustrates a first example of a system 
malfunction that can be detected by the inventive method based 
on a discrepancy between a given control target and the actually 
occurring behavior of the system. 

An actuator movement from 0 to 15 mm within a set time 
is given as a target profile 50. The actually occurring 
actuator displacement (54) closely follows the target profile up 
to a displacement of 6 mm, where it abruptly stops and remains 
at a constant position. As there is now a discrepancy between 
the targeted and the actually occurring displacement, as 
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indicated by the double-ended arrow 52, the target profile is 
adjusted to match the actually occurring displacement. This 
measure is appropriate to protect the system from further 
damage. However, the protective measure alone does not provide 
an error detection unless further steps are taken. 

The detection and evaluation of the malfunction requires 
registering the fact that the time gradient of the actually 
occurring displacement profile 54 agrees substantially with the 
gradient of the target profile 50, while the profiles themselves 
are in significant disagreement. The parameters defining this 
behavior can be used to evaluate the malfunction. 

Fig. 3 illustrates a second example of a discrepancy 
between a given control target and the actually occurring 
behavior of the system, which is indicative of a malfunction in 
the overall system. 

The target profile represents again an actuator movement 
from the zero position to a displacement of 15 mm, while the 
actually occurring displacement only reaches a position between 
6 and 15 mm. 

The discrepancy between the actual behavior and the 
target profile in the example of Fig. 3 is not as large as in 
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the case of Fig. 2. 

Nevertheless, there is a significant difference in the 
slope gradient 60 of the target profile and the gradient 60 of 
5 the actual displacement profile. The system uses the gradient 

data in an evaluation routine. The significant discrepancy 
between the gradients is indicative of a malfunction. 

Without further analysis, the foregoing will so fully 
; -l0 reveal the gist of the present invention that others can, by 

applying current knowledge, readily adapt it for various 
W applications without omitting features that, from the standpoint 

2 of prior art, fairly constitute essential characteristics of the 

f generic and specific aspects of the af oredescribed contribution 

tis to the art and, therefore, such adaptations should and are 

Jf:f intended to be comprehended within the meaning and range of 

r ~ equivalence of the appended claims. 
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